CVE-2026-30244: Plane: Unauthenticated Workspace Member Information Disclosure
Executive Summary
A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints.
This vulnerability enables attackers to:
- Enumerate all members of any workspace without authentication - Extract user email addresses and personally identifiable information (PII) - Identify administrative accounts for targeted attacks - Map organizational structure and user roles - Conduct reconnaissance for social engineering attacks
Affected Endpoints:
GET /api/public/workspaces/{workspaceslug}/members/ GET /api/public/workspaces/{workspaceslug}/projects/{projectid}/members/ A fix is available at https://github.com/makeplane/plane/releases/tag/v1.2.3.
Other sources
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30244?
CVE-2026-30244 is classified as a medium severity vulnerability.
How do I fix CVE-2026-30244?
To fix CVE-2026-30244, update the Plane package to version 1.2.2 or later.
What type of information can be disclosed due to CVE-2026-30244?
CVE-2026-30244 can lead to the disclosure of sensitive information such as email addresses and user roles of workspace members.
Who is affected by CVE-2026-30244?
CVE-2026-30244 affects users of the Plane project management platform versions prior to 0.2.1.
Can unauthenticated users exploit CVE-2026-30244?
Yes, unauthenticated users can exploit CVE-2026-30244 to enumerate workspace members and extract sensitive data.